StackRadar

CVE-2017-18640

High

Advisory

Published 4 Jun 2021In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.267
98th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
137
of 17,781 indexed, latest versions
Container images
126
deployed by those charts
Fix available
1 of 1
affected package

SnakeYAML Entity Expansion during load operation

Carried by container images the latest versions of 137 of 17,781 indexed charts deploy, on 126 images.

Affected packageAffected versionsFixed inImages
snakeyamlmaven1.11, 1.12, 1.13, 1.15+9 more1.26126
OSV records
GHSA-rvwf-54qp-4r6v

Charts affected

137 by stars
ChartLatestAffected imagesRadar Score
apicurio-registryapicurio-registry-helmVerified publisher3.8.01 of 2See more

apicurio-registry apicurio-registry-helm 3.8.0

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
quay.io/apicurio/apicurio-registry-kube-sync:1.0.170ef31840269
snakeyaml@1.16
1.26

Open the chart page →

6,675
zipkincarlosjgp0.2.01 of 2See more

zipkin carlosjgp 0.2.0

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
openzipkin/zipkin:2.21.060c3970df479
snakeyaml@1.25
1.26

Open the chart page →

3,229
temporallemontechVerified publisher0.37.01 of 13See more

temporal lemontech 0.37.0

1 of the 13 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
library/cassandra:3.11.3ce85468c5bad
snakeyaml@1.11
1.26

Open the chart page →

14,893
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
microcks/microcks:0.8.0e3a3e0c67b09
snakeyaml@1.16
1.26

Open the chart page →

10,732
sparkmicrosoft1.0.42 of 3See more

spark microsoft 1.0.4

2 of the 3 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
dbanda/livy:0.80ca125e68e53
snakeyaml@1.15
1.26
dbanda/spark:2.4.6d0e6367876ae
snakeyaml@1.16
1.26

Open the chart page →

13,738
selenium3selenium31.2.41 of 1See more

selenium3 selenium3 1.2.4

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
selenium/hub:3.141.5902f251d48d5f
snakeyaml@1.19
1.26

Open the chart page →

11,782
hadoopbigdata-chartsVerified publisher1.0.11 of 2See more

hadoop bigdata-charts 1.0.1

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
marcelmay/hadoop-hdfs-fsimage-exporter:1.3abeccb740ef7
snakeyaml@1.25
1.26

Open the chart page →

12,111
jira-softwaremoxVerified publisher2.7.11 of 3See more

jira-software mox 2.7.1

1 of the 3 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
atlassian/jira-software:9.7.264a75aa4ec4e
snakeyaml@1.19
1.26

Open the chart page →

8,636
cloudflowcloudflow-helm-charts0.0.0-NIGHTLY011220201 of 1See more

cloudflow cloudflow-helm-charts 0.0.0-NIGHTLY01122020

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
lightbend/cloudflow-operator:0.0.0-NIGHTLY011220202647f396de23
snakeyaml@1.25
1.26

Open the chart page →

1,886
hdfsdmwm-bigdataVerified publisher1.0.12 of 2See more

hdfs dmwm-bigdata 1.0.1

2 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
gradiant/hdfs:3.2.2e3bf364fe713
snakeyaml@1.16
1.26
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
snakeyaml@1.20
1.26

Open the chart page →

7,948
hivedmwm-bigdataVerified publisher0.1.61 of 5See more

hive dmwm-bigdata 0.1.6

1 of the 5 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
snakeyaml@1.20
1.26

Open the chart page →

20,837
rocketmqgin1.1.01 of 2See more

rocketmq gin 1.1.0

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:1.0.024799aff6cf8
snakeyaml@1.19
1.26

Open the chart page →

9,154
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
snakeyaml@1.24
1.26

Open the chart page →

10,311
hive-metastoreheva-helm-chartsVerified publisher0.2.01 of 2See more

hive-metastore heva-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
sslhep/hive-metastore:3.1.39e80af083079
snakeyaml@1.16
1.26

Open the chart page →

7,335
skywalkingkubesphere-testVerified publisher3.1.02 of 4See more

skywalking kubesphere-test 3.1.0

2 of the 4 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.1.0-es7641237e0299b
snakeyaml@1.18
1.26
apache/skywalking-ui:8.1.067d50e4deff4
snakeyaml@1.17
1.26

Open the chart page →

18,042
oesopsmxVerified publisher4.0.322 of 25See more

oes opsmx 4.0.32

2 of the 25 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/awsgit:v2-openssh0d21ba756f44
snakeyaml@1.23
1.26
quay.io/opsmxpublic/awsgit:v3-js15a6faada3d4
snakeyaml@1.23
1.26

Open the chart page →

107,811
activemq-artemisactivemq-artemis-helm0.3.61 of 1See more

activemq-artemis activemq-artemis-helm 0.3.6

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
vromero/activemq-artemis:2.16.0408d6a46b153
snakeyaml@1.16
1.26

Open the chart page →

4,419
ignitecloudnativeapp1.0.01 of 1See more

ignite cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
apacheignite/ignite:2.7.0d7deab68b8fa
snakeyaml@1.11
1.26

Open the chart page →

7,891
hbasedmwm-bigdataVerified publisher0.1.63 of 5See more

hbase dmwm-bigdata 0.1.6

3 of the 5 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
snakeyaml@1.18
1.26
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
snakeyaml@1.20
1.26
spdigital/prometheus-jmx-exporter-kubernetes:0.3.1e916950138ee
snakeyaml@1.16
1.26

Open the chart page →

13,392
opentsdbdmwm-bigdataVerified publisher0.1.73 of 6See more

opentsdb dmwm-bigdata 0.1.7

3 of the 6 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
snakeyaml@1.18
1.26
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
snakeyaml@1.20
1.26
spdigital/prometheus-jmx-exporter-kubernetes:0.3.1e916950138ee
snakeyaml@1.16
1.26

Open the chart page →

17,511
spinnakerdwardu-helm-charts2.2.61 of 2See more

spinnaker dwardu-helm-charts 2.2.6

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
snakeyaml@1.25
1.26

Open the chart page →

8,752
nifi-registrydysnixVerified publisher1.1.51 of 2See more

nifi-registry dysnix 1.1.5

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
apache/nifi-registry:0.8.0974efa2f21da
snakeyaml@1.20
1.26

Open the chart page →

6,531
elasticsearch-dataempathyco0.2.01 of 2See more

elasticsearch-data empathyco 0.2.0

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
empathyco/elasticsearch:6.6.2-memlockbcf4365ee7ec
snakeyaml@1.17
1.26

Open the chart page →

3,703
elasticsearch-masterempathyco0.3.01 of 2See more

elasticsearch-master empathyco 0.3.0

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
empathyco/elasticsearch:6.6.2-memlockbcf4365ee7ec
snakeyaml@1.17
1.26

Open the chart page →

3,703
temporalglasskubeVerified publisher0.45.2-gk.11 of 14See more

temporal glasskube 0.45.2-gk.1

1 of the 14 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
library/cassandra:3.11.3ce85468c5bad
snakeyaml@1.11
1.26

Open the chart page →

16,346
hbasegradiant-bigdataVerified publisher0.1.63 of 5See more

hbase gradiant-bigdata 0.1.6

3 of the 5 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
snakeyaml@1.18
1.26
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
snakeyaml@1.20
1.26
spdigital/prometheus-jmx-exporter-kubernetes:0.3.1e916950138ee
snakeyaml@1.16
1.26

Open the chart page →

13,392
supertokensgraphql-hive-subcharts1.0.01 of 1See more

supertokens graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
snakeyaml@1.24
1.26

Open the chart page →

2,709
hertzbeatkubesphere-testVerified publisher1.4.11 of 4See more

hertzbeat kubesphere-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
apache/iotdb:0.13.3-nodeafa47bf1692a
snakeyaml@1.17
1.26

Open the chart page →

7,710
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.11 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

1 of the 6 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
torrespro/mca-worker:2.0.06d3bd305a1ba
snakeyaml@1.25
1.26

Open the chart page →

19,187
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
snakeyaml@1.18
1.26

Open the chart page →

7,529
routrroutr0.0.101 of 2See more

routr routr 0.0.10

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
fonoster/routr:1.0.0-rc52ca65af17cbc
snakeyaml@1.18
1.26

Open the chart page →

4,983
seldon-coreseldon0.2.72 of 3See more

seldon-core seldon 0.2.7

2 of the 3 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
seldonio/apife:0.2.7ba81b17f00eb
snakeyaml@1.17
1.26
seldonio/cluster-manager:0.2.729e362bb1ba2
snakeyaml@1.17
1.26

Open the chart page →

13,798
signserver-cesignserverOfficialVerified publisher2.3.51 of 1See more

signserver-ce signserver 2.3.5

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.3.2798fbbe00283
snakeyaml@1.19
1.26

Open the chart page →

2,406
graylogt3n1.0.01 of 3See more

graylog t3n 1.0.0

1 of the 3 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
graylog2/server:2.4.3-38ff28c66e6c1
snakeyaml@1.17
1.26

Open the chart page →

8,063
apache-iotdbapache-iotdb-single-nodeVerified publisher0.1.01 of 1See more

apache-iotdb apache-iotdb-single-node 0.1.0

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
apache/iotdb:0.11.28647309f95d1
snakeyaml@1.17
1.26

Open the chart page →

5,277
d.vazquezm.2021_helmapphelmVerified publisher1.0.01 of 6See more

d.vazquezm.2021_helm apphelm 1.0.0

1 of the 6 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
davidvmar/urjc-davidvmar-worker:1.0.10d221e834a21
snakeyaml@1.25
1.26

Open the chart page →

19,745
automatedconfigurationassist-iot-automated-configuration1.0.01 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

1 of the 5 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
assistiot/automated_configuration:latest23f195a7a26a
snakeyaml@1.23
1.26

Open the chart page →

14,728
sdn-controllerassist-iot-sdn-controller2.4.01 of 1See more

sdn-controller assist-iot-sdn-controller 2.4.0

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
assistiot/sdn_controller:2.4.0ea254b6d8a31
snakeyaml@1.18
1.26

Open the chart page →

7,936
jaegerbook-k8sinfra-v23.4.01 of 5See more

jaeger book-k8sinfra-v2 3.4.0

1 of the 5 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
library/cassandra:3.11.65aa8400b4b3b
snakeyaml@1.11
1.26

Open the chart page →

19,229
puppetservercamptocamp31.0.11 of 2See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
camptocamp/jmx-exporter:0.12.058b9306482da
snakeyaml@1.16
1.26

Open the chart page →

5,886
cassandra-clustercassandra-clusterVerified publisher0.1.01 of 1See more

cassandra-cluster cassandra-cluster 0.1.0

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
library/cassandra:3.11.10b095ff3248c6
snakeyaml@1.11
1.26

Open the chart page →

9,473
temporalcastaiVerified publisher0.54.21 of 14See more

temporal castai 0.54.2

1 of the 14 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
library/cassandra:3.11.3ce85468c5bad
snakeyaml@1.11
1.26

Open the chart page →

16,198
tsoragecetic0.4.112 of 8See more

tsorage cetic 0.4.11

2 of the 8 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:5.0.1c87b1c07fb53
snakeyaml@1.18
1.26
library/cassandra:3.11.598531a31f213
snakeyaml@1.11
1.26

Open the chart page →

12,018
event-store-servicechoerodon0.8.01 of 2See more

event-store-service choerodon 0.8.0

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
choerodon/event-store-service:0.8.03c94c97f6f69
snakeyaml@1.17
1.26

Open the chart page →

9,808
cassandra-reapercloudnativeapp0.2.01 of 1See more

cassandra-reaper cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
thelastpickle/cassandra-reaper:1.3.09c53996c457d
snakeyaml@1.11
1.26

Open the chart page →

5,078
gocdcloudnativeapp1.9.21 of 2See more

gocd cloudnativeapp 1.9.2

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
gocd/gocd-server:v19.3.02da45cb09d57
snakeyaml@1.18
1.26

Open the chart page →

9,144
metabasecloudnativeapp0.5.01 of 1See more

metabase cloudnativeapp 0.5.0

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
metabase/metabase:v0.31.2ffb2dccacefc
snakeyaml@1.18
1.26

Open the chart page →

4,601
prometheus-cloudwatch-exportercloudnativeapp0.4.51 of 1See more

prometheus-cloudwatch-exporter cloudnativeapp 0.4.5

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
prom/cloudwatch-exporter:cloudwatch_exporter-0.5.0923705b2ae77
snakeyaml@1.17
1.26

Open the chart page →

2,629
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
snakeyaml@1.17
1.26

Open the chart page →

23,665
seleniumcloudnativeapp1.0.81 of 1See more

selenium cloudnativeapp 1.0.8

1 of the 1 container images this version deploys carry CVE-2017-18640.

Container imageDigestPackageFixed in
selenium/hub:3.141.5902f251d48d5f
snakeyaml@1.19
1.26

Open the chart page →

11,782

Container images carrying it

126 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
snakeyaml@1.17
1.26
1
richardchesterwood/k8s-fleetman-position-simulator:release20b540a28f5a6
snakeyaml@1.17
1.26
1
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
snakeyaml@1.17
1.26
1
rundeck/rundeck:3.2.74d64fe56f767
snakeyaml@1.24
1.26
1
rundeck/rundeck:3.0.16b13e8059ad72
snakeyaml@1.17
1.26
1
sdandey/dandey-apps:kanban-board-kanban-appbef0f599737b
snakeyaml@1.23
1.26
1
seldonio/apife:0.2.7ba81b17f00eb
snakeyaml@1.17
1.26
1
seldonio/apife:0.3.1eea0d3f578ca
snakeyaml@1.17
1.26
1
seldonio/cluster-manager:0.2.729e362bb1ba2
snakeyaml@1.17
1.26
1
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
snakeyaml@1.15
1.26
1
sslhep/hive-metastore:3.1.39e80af083079
snakeyaml@1.16
1.26
1
thelastpickle/cassandra-reaper:1.3.09c53996c457d
snakeyaml@1.11
1.26
1
torrespro/mca-worker:2.0.06d3bd305a1ba
snakeyaml@1.25
1.26
1
trinodb/trino:405ee80ab5eeab2
snakeyaml@1.11
1.26
1
voltha/voltha-onos:5.1.8e038acb950d3
snakeyaml@1.18
1.26
1
vromero/activemq-artemis:2.16.0408d6a46b153
snakeyaml@1.16
1.26
1
xetusoss/archiva:v2.2.588f25242b9ee
snakeyaml@1.11
1.26
1
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
snakeyaml@1.25
1.26
1
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
snakeyaml@1.18
1.26
1
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
snakeyaml@1.25
1.26
1
ghcr.io/skyoo2003/digdag:0.0.1821fd6a6f2cd
snakeyaml@1.23
1.26
1
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
snakeyaml@1.23
1.26
1
quay.io/apicurio/apicurio-registry-kube-sync:1.0.170ef31840269
snakeyaml@1.16
1.26
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
snakeyaml@1.13
1.26
1
quay.io/opsmxpublic/awsgit:v2-openssh0d21ba756f44
snakeyaml@1.23
1.26
1
quay.io/opsmxpublic/awsgit:v3-js15a6faada3d4
snakeyaml@1.23
1.26
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.